{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:61813118-48aa-51c9-82dc-6e8b9d50df2c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.3-tuxcare.1", "type": "library", "bom-ref": "pkg:npm/dompurify@3.0.3-tuxcare.1", "version": "3.0.3-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:0b0fc15f-478d-53fb-ab7c-f0ab8aab4672", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45801 is fixed in version 3.0.3-tuxcare.1 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:7815d1b4-d4c6-530f-8e4a-0f9f1f2dafb2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47875 is fixed in version 3.0.3-tuxcare.1 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:9bf3fdf4-5999-5301-9289-edd143e17f97", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.0.3-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:a04f5bf7-6060-506a-a1a0-ad89648bfed2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-0540 affects version 3.0.3-tuxcare.1 of dompurify, and is fixed in 3.0.3-tuxcare.2." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:ae0c11c2-ff8e-5345-b20e-76a1521c55bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.0.3-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:eb0a7df3-22d4-5e89-89d3-a7832db46923", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.0.3-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:24f7c1b3-0d48-5c8d-a7ca-94f919047df6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 3.0.3-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:64f4c657-223e-5367-88df-1f57a7d33b18", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 3.0.3-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:51049ade-e86d-5cca-aa70-6f1ef1c434bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.0.3-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:fd1998d1-d9a9-59e3-9793-26855b88028e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 3.0.3-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:6dfdbd25-337d-5278-bfe3-6924cfa9f87a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.0.3-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:59ad15a4-11c9-5d16-9795-8fed69e1f612", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 3.0.3-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:206a4d27-7fc9-5049-ab6c-61b454453965", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.0.3-tuxcare.1 of dompurify, and is fixed in 3.0.3-tuxcare.5." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:52a54e85-6da6-571e-a4f4-4e6e4a28b5ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.0.3-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:01b2d61d-47ed-5b66-9af8-c492a0cd4acc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 3.0.3-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:c81c29e3-17dc-572c-b7fc-884d8f96edf7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.0.3-tuxcare.1 of dompurify. not_affected \u2014 Target version 3.0.3-tuxcare.3 is not affected by CVE-2026-65903. The vulnerable code pattern described in the CVE (single-line condition with short-circuit evaluation bypassing FORBID_TAGS) does not exist in this version. The target uses a nested conditional structure that explicitly checks !FORBID_TAGS[tagName] before allowing custom element tagNameCheck evaluation, which is the exact mitigat..." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:7e7b85f8-67a3-5a83-8ad7-50408ea12228", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65912 affects version 3.0.3-tuxcare.1 of dompurify, and is fixed in 3.0.3-tuxcare.4." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:c9e6ec81-335b-5040-9498-feb0f2389eb5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 3.0.3-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:1d93aff3-6b9f-5786-a522-9b58053d34a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 3.0.3-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:d996e6d4-4bbe-5e45-acf6-4eec973c04fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.0.3-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:e6129187-23fc-5627-ac0e-d1c070c4191f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-75838 affects version 3.0.3-tuxcare.1 of dompurify, and is fixed in 3.0.3-tuxcare.5." } }, { "id": "GHSA-39q2-94rc-95cp", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:da5ee67e-4ee6-5f7b-9be0-06d84878dbfa", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-39q2-94rc-95cp is fixed in version 3.0.3-tuxcare.1 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:2f1a5d26-9a76-52d3-80b6-423818a1aa65", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.0.3-tuxcare.1 of dompurify." } }, { "id": "GHSA-76mc-f452-cxcm", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:652dac00-d4d9-56c5-92e5-6414ad16dd2e", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-76mc-f452-cxcm affects version 3.0.3-tuxcare.1 of dompurify, and is fixed in 3.0.3-tuxcare.2." } }, { "id": "GHSA-c2j3-45gr-mqc4", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:f4f47bbb-763d-5eb5-88bc-87b18ef1ddbe", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c2j3-45gr-mqc4 affects version 3.0.3-tuxcare.1 of dompurify, and is fixed in 3.0.3-tuxcare.3." } }, { "id": "GHSA-cj63-jhhr-wcxv", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:be27b31e-c338-5dcb-9590-ad4b5e297aa2", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cj63-jhhr-wcxv is fixed in version 3.0.3-tuxcare.1 of dompurify." } }, { "id": "GHSA-cjmm-f4jc-qw8r", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:7eb61756-fa7b-53c8-a55a-162a5ea19822", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cjmm-f4jc-qw8r is fixed in version 3.0.3-tuxcare.1 of dompurify." } }, { "id": "GHSA-cmwh-pvxp-8882", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:a7407fd8-d6c3-55e2-ada8-260c65fe5687", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-cmwh-pvxp-8882 affects version 3.0.3-tuxcare.1 of dompurify, and is fixed in 3.0.3-tuxcare.2." } }, { "id": "GHSA-gvmj-g25r-r7wr", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:9c5f0309-0fef-5682-b3c1-431d60783345", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-gvmj-g25r-r7wr affects version 3.0.3-tuxcare.1 of dompurify, and is fixed in 3.0.3-tuxcare.2." } }, { "id": "GHSA-h8r8-wccr-v5f2", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:3b0baffb-fa13-5065-8f9e-931cb0fbbfb5", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h8r8-wccr-v5f2 is fixed in version 3.0.3-tuxcare.1 of dompurify." } }, { "id": "GHSA-vxr8-fq34-vvx9", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:92071742-1cf1-5768-9828-8165ff595fe2", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-vxr8-fq34-vvx9 affects version 3.0.3-tuxcare.1 of dompurify, and is fixed in 3.0.3-tuxcare.2." } }, { "id": "GHSA-x4vx-rjvf-j5p4", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:1a160a30-e21e-5469-b2f3-b39de062ee82", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-x4vx-rjvf-j5p4 affects version 3.0.3-tuxcare.1 of dompurify, and is fixed in 3.0.3-tuxcare.2." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.1" } ] }